ZoKB Checklist 2026: What Your Company Must Complete Within One Year of Registration

A major milestone under the new Czech Cybersecurity Act (ZoKB) is approaching for thousands of Czech organisations. Act No. 264/2025 Coll. has been in force since 1 November 2025, and more than 4,500 organisations notified the authorities of a regulated service during the first two months. However, the Czech National Cyber and Information Security Agency (NÚKIB) continues to report that thousands of other businesses likely covered by the Act have yet to submit a notification.

The one-year transition period runs from the date the decision registering a regulated service is delivered, rather than from the initial notification. During this period, organisations must implement the required security measures and prepare to meet their obligations for reporting cybersecurity incidents.

The purpose of ZoKB goes beyond meeting formal requirements. Above all, an organisation should know what it is protecting, which risks it faces and how it can respond to a security issue.

Do you have these ten areas under control?

1. Do you know what you are protecting?

Cybersecurity starts with a clear overview of the regulated services provided and the important assets associated with them. An organisation should know which systems, information and data are critical to its operations, how they depend on one another and who is responsible for them. Without this information, it is difficult to set security priorities.

2. Are responsibilities clearly assigned?

Cybersecurity is not solely the responsibility of the IT department. Management must understand significant risks, provide the necessary resources and maintain an overview of the security posture. It must also be clear who is responsible for individual measures and risk-related decisions. Managers must understand the value of data and information and enforce secure handling practices. Employees must know which activities are safe and how to work securely within the organisation. Security is a discipline that spans the entire organisation.

3. Are you managing cyber risks?

Simply identifying risks and recording them in a spreadsheet is not enough. An organisation should assess their severity, set priorities and decide how to proceed. Risks must have owners and specific treatment plans. Regular reassessment is also important. A risk should be understood as something the organisation must address, rather than just an entry on a formal list. Risk management is the foundation of effective and secure IT.

4. Have you implemented security measures?

ZoKB requires organisational and technical measures appropriate to the applicable regulatory regime. These include, for example, access control, system security, change management and the protection of important information. What matters is not the number of technologies deployed, but whether the measures actually work and address the organisation’s risks. The Statement of Applicability provides an overview of the controls implemented and the extent to which they function and are effective.

5. Do you know how to respond to an incident?

During a cyber incident, it must be clear who assesses the situation, who leads the response and how escalation works. Employees must know where to report suspicious events, and the people responsible must understand the statutory deadlines and rules for reporting relevant incidents. Established procedures should also be tested in practice. A security incident is always an unpleasant and stressful situation, so thorough preparation is essential.

6. Can you restore operations?

Cyber resilience includes the ability to restore important systems and services after an incident. An organisation needs defined recovery priorities, appropriate backups and workable procedures for crisis situations. Having backups is not enough: their usability must be verified regularly.

7. Do you understand your suppliers’ risks?

Cloud services, outsourced IT and technology partners can significantly affect the security of a regulated service. An organisation should therefore understand its significant supplier dependencies, assess the associated risks and incorporate relevant security requirements into contracts. Supplier risks must also be monitored throughout the relationship. Excessive dependence on suppliers without adequate contractual protection can itself be a significant risk that needs to be mitigated.

8. Are your employees prepared?

Security rules work only when employees understand and follow them. Training should reflect their job roles and the risks they actually face. Proper access management when employees join, change roles or leave is also important. Specialists need training too: learning is a path to growth.

9. Does your documentation reflect reality?

Security policies and procedures must reflect how the organisation actually operates, rather than an ideal situation on paper. Documentation should be up to date, have clearly assigned owners and make it possible to demonstrate that the organisation actually implements the measures described.

10. Do you know what still needs to be addressed?

An organisation should maintain an ongoing overview of unmet requirements, outstanding risks and corrective actions. Every significant finding needs an owner, a priority and a deadline for resolution. Without this overview, compliance can easily become a collection of disconnected spreadsheets and tasks.

What does the end of the one-year transition period mean?

For some organisations, the one-year deadline will approach around the turn of 2026 and 2027. The exact date always depends on when the decision registering the regulated service was delivered.

However, cybersecurity work does not end when this deadline expires. New assets, suppliers and vulnerabilities emerge, and security measures need to be updated continuously.

As the number of requirements grows, keeping track of compliance can become increasingly difficult. Tools such as AuditMaster help bring asset management, risk management, corrective actions and supplier management together in one environment. AuditMaster has eight interconnected modules and helps you maintain control over your entire information security management system.

The goal of ZoKB is not merely to pass an inspection. It is to build an organisation that understands its risks, knows what it is protecting and can respond effectively to a security incident.